Add CORS, because otherwise this could be quite tricky